impel-cli 0.18.9 → 0.18.11-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.9",
+  "version": "0.18.11-beta.0",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -42,42 +42,41 @@ const APP_DEFINITIONS = {
 // CLI release therefore installs and accepts only the exact app builds tested
 // with its compatibility patches. Updating a pin requires a new CLI release.
 export const PINNED_VENDOR_APPS = Object.freeze({
-  // 1.22209.3 (the previous pin) routes every managed 3P gateway profile into
-  // the Claude Code marketing page at app://localhost/code/disabled: the
-  // desktop Code surface never becomes available, the hardcoded-off
-  // claude_code_web gate traps /code/*, and the page's "Back to Claude" link
-  // targets "/" so the persisted Code mode loops straight back. 1.20186.9 is
-  // the last build verified working end-to-end for gateway profiles. Do not
-  // re-upgrade without a verified fix for the Code-surface routing contract.
+  // 1.22209.3 routed managed 3P gateway profiles into /code/disabled because
+  // it did not translate the managed desktop-Code switch into renderer access.
+  // 1.24012.9 restores that contract by synthesizing claude_code and
+  // claude_code_desktop access from the configured code surface. The pinned
+  // contract test asserts that source path directly so this regression cannot
+  // hide behind otherwise-valid configLibrary schema markers again.
   claude: Object.freeze({
-    version: "1.20186.9",
-    claudeCodeVersion: "2.1.209",
-    claudeCodeCommit: "0fe048596fd45e79e99353cbe2c3d1b1ac069568",
+    version: "1.24012.9",
+    claudeCodeVersion: "2.1.219",
+    claudeCodeCommit: "7006c4c3acac98e554d3997baeda6a7fa4d1ff7c",
     bundleName: "Claude.app",
     windows: Object.freeze({
       packageName: "Claude",
-      packageVersion: "1.20186.9.0",
+      packageVersion: "1.24012.9.0",
       publisher: 'CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US',
       executable: "app\\Claude.exe",
       downloads: Object.freeze({
         arm64: Object.freeze({
-          url: "https://downloads.claude.ai/releases/win32/arm64/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.msix",
-          sha256: "9a0591a0d9e298dea92d5547ee259f35e818ce0b1982512ad1550f5ed2744c39",
+          url: "https://downloads.claude.ai/releases/win32/arm64/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.msix",
+          sha256: "52ed0402ca70fc95e064417ff9bdf3a6336fe5dbf0612f7797937fd0d35ecdba",
         }),
         x64: Object.freeze({
-          url: "https://downloads.claude.ai/releases/win32/x64/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.msix",
-          sha256: "55a0b8f8c3c8d46cd64a03d3f42818da28f312cd4be904265cd61baee7ea68a5",
+          url: "https://downloads.claude.ai/releases/win32/x64/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.msix",
+          sha256: "c7d61479f06a3490bd2598405aa95a428abb9fe31ed97f9e0a1fba7cd2745fe2",
         }),
       }),
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
-        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.zip",
+        sha256: "39ad2d181e2b1b017c5506f66c08399c23575c802d8b63927f40128e77103a9b",
       }),
       x64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
-        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.zip",
+        sha256: "39ad2d181e2b1b017c5506f66c08399c23575c802d8b63927f40128e77103a9b",
       }),
     }),
   }),
@@ -109,16 +108,14 @@ const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning
 const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
 const CHATGPT_RESOURCE_ROOT = "linked_vendor_resources_with_patched_asar";
-const CLAUDE_PLAN_USAGE_GUARD = "if(!Ze().hasOrgPolicyBackend())return;if((r=fr())";
-const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `${"if(!wze())return;".padEnd("if(!Ze().hasOrgPolicyBackend())return;".length, " ")}if((r=fr())`;
-const CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch(`${ht()}/api/organizations/${o}/usage`,{signal:AbortSignal.timeout(mcr)})';
-const IMPEL_CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:dR(Oe()).apiKey}})'.padEnd(CLAUDE_PLAN_USAGE_REQUEST.length, " ");
-const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be&&s';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be?s:Le?.agent??!1';
-const CLAUDE_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))).slice(0,10)';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))&&("string"!=typeof y||e.name===y)).slice(0,10)';
+const CLAUDE_PLAN_USAGE_GUARD = "if(!PSe()){cz();return}if(!Ge().hasOrgPolicyBackend())return;if((r=ar())";
+const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!PSe()){cz();return}${"".padEnd("if(!Ge().hasOrgPolicyBackend())return;".length, " ")}if((r=ar())`;
+const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ge&&t';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ge?t:Ue?.agent??!1';
+const CLAUDE_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!n||e.name.toLowerCase().includes(n))).slice(0,10)';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!n||e.name.toLowerCase().includes(n))&&("string"!=typeof x||e.name===x)).slice(0,10)';
 const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(null))';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof y?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof x?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
 // The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
@@ -157,7 +154,8 @@ const escapedDisplayPrefix = RUNTIME_BRAND.apps.displayPrefix.replace(/[.*+?^${}
 const LEGACY_TRAPPED_CLAUDE_NAME = new RegExp(`^${escapedDisplayPrefix} Claude( \\[[^\\]]+\\])?$`, "u");
 
 export const FALLBACK_MODELS = [
-  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", family_default: true, default: true, context_window: 200000 },
+  { id: "claude-opus-5", provider: "claude", display_name: "Claude Opus 5", family: "opus", family_default: true, default: true, supports_1m: true, context_window: 1000000 },
+  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", supports_1m: true, context_window: 1000000 },
   { id: "claude-sonnet-5", provider: "claude", display_name: "Claude Sonnet 5", family: "sonnet", family_default: true, context_window: 200000 },
   { id: "claude-sonnet-4-6", provider: "claude", display_name: "Claude Sonnet 4.6", family: "sonnet", context_window: 200000 },
   { id: "claude-haiku-4-5", provider: "claude", display_name: "Claude Haiku 4.5", family: "haiku", family_default: true, context_window: 200000 },
@@ -240,7 +238,7 @@ export const CURRENT_CONFIG_VERSION = 21;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-21.2";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-25.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -835,10 +833,21 @@ export function isVendableVendorApp(target, appPath) {
   const hasExecutable = definition.executableNames.some((name) =>
     fs.existsSync(path.join(appPath, "Contents", "MacOS", name)),
   );
+  const hasClaudeSimulator = target !== "claude" || (
+    fs.existsSync(path.join(
+      appPath,
+      "Contents", "Helpers", "Claude iOS Sim.app", "Contents", "Info.plist",
+    ))
+    && fs.existsSync(path.join(
+      appPath,
+      "Contents", "Helpers", "Claude iOS Sim.app", "Contents", "MacOS", "claude-ios-sim",
+    ))
+  );
   return (
     hasExecutable
     && fs.existsSync(path.join(appPath, "Contents", "Info.plist"))
     && fs.existsSync(path.join(appPath, "Contents", "Resources", "app.asar"))
+    && hasClaudeSimulator
   );
 }
 
@@ -1022,11 +1031,7 @@ function writeClaudeConfig(paths, config, models) {
   const experimental = crossAppModelsEnabled(config);
   const claudeModels = experimental
     ? projectClaudeDesktopModels(models)
-    : models.filter((model) => model.provider === "claude").map((model) => ({
-      name: model.id,
-      ...(model.family ? { anthropicFamilyTier: model.family } : {}),
-      ...(model.family_default ? { isFamilyDefault: true } : {}),
-    }));
+    : models.filter((model) => model.provider === "claude").map(nativeClaudeDesktopModel);
   const body = {
     inferenceProvider: "gateway",
     inferenceGatewayBaseUrl: experimental
@@ -1061,6 +1066,28 @@ function writeClaudeConfig(paths, config, models) {
   }, null, 2) + "\n", 0o600);
 }
 
+function nativeClaudeDesktopModel(model) {
+  const capability = model.client_capabilities?.claude_desktop;
+  const label = typeof capability?.label === "string" && capability.label.trim()
+    ? capability.label
+    : null;
+  const family = typeof capability?.anthropic_family_tier === "string"
+    && capability.anthropic_family_tier
+    ? capability.anthropic_family_tier
+    : model.family;
+  return {
+    name: model.id,
+    ...(label ? { labelOverride: label } : {}),
+    ...(family ? { anthropicFamilyTier: family } : {}),
+    ...(capability?.family_default === true || model.family_default === true
+      ? { isFamilyDefault: true }
+      : {}),
+    ...(capability?.supports_1m === true || model.supports_1m === true
+      ? { supports1m: true }
+      : {}),
+  };
+}
+
 function writeClaudeCodeSettings(paths) {
   const settingsPath = path.join(paths.claude.userData, "settings.json");
   let settings = {};
@@ -1484,6 +1511,12 @@ exec "$NODE" "$CLI" token${tenantArgs}
 
 function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageName) {
   if (!vendorPath) throw new Error("Claude vendor app is unavailable");
+  if (!isVendableVendorApp("claude", vendorPath)) {
+    const bundleId = readBundleIdentifier(vendorPath);
+    throw new Error(
+      `unsupported Claude bundle layout in ${vendorPath}${bundleId ? ` (bundle id ${bundleId})` : ""}`,
+    );
+  }
   const executableName = APP_DEFINITIONS.claude.executableNames.find((name) => (
     fs.existsSync(path.join(vendorPath, "Contents", "MacOS", name))
   ));
@@ -1832,23 +1865,6 @@ function patchFixedWidthAsarString(asarPath, original, replacement, label) {
 function patchClaudePlanUsageRequest(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");
-  const legacyPatches = [];
-  for (
-    let offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST);
-    offset !== -1;
-    offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST, offset + CLAUDE_PLAN_USAGE_REQUEST.length)
-  ) {
-    legacyPatches.push({
-      offset,
-      original: CLAUDE_PLAN_USAGE_REQUEST,
-      replacement: IMPEL_CLAUDE_PLAN_USAGE_REQUEST,
-    });
-  }
-  if (legacyPatches.length > 0) {
-    return applyFixedWidthAsarPatches(
-      asarPath, archive, legacyPatches, "Claude plan-usage gateway request",
-    );
-  }
   const credentialAccessor = source.match(
     /function ([A-Za-z_$][\w$]*)\(e\)\{var t;return [\s\S]{0,500}?\[custom-3p\] Credentials loaded from managed config/u,
   )?.[1];
@@ -1864,10 +1880,10 @@ function patchClaudePlanUsageRequest(asarPath) {
     return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude plan-usage gateway request");
   }
 
-  const requestPattern = /([A-Za-z_$][\w$]*)\.net\.fetch\(`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage`,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
+  const requestPattern = /const ([A-Za-z_$][\w$]*)=`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage\$\{[A-Za-z_$][\w$]*\?"\?skip_spend=1":""\}`,([A-Za-z_$][\w$]*)=await ([A-Za-z_$][\w$]*)\.net\.fetch\(\1,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
   const patches = [...source.matchAll(requestPattern)].map((match) => {
     const original = match[0];
-    const replacement = `${match[1]}.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
+    const replacement = `const ${match[1]}="https://gateway.useimpel.com/ui/a/u",${match[2]}=await ${match[3]}.net.fetch(${match[1]},{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
     if (replacement.length > original.length) {
       throw new Error("Claude plan-usage gateway request replacement no longer fits the vendor ASAR contract");
     }

package/src/commands/doctor.js

@@ -161,7 +161,6 @@ export async function cmdDoctor(argv) {
     flags.gateway !== undefined
       ? flags.gateway
       : process.env[brandedEnvironmentName("GATEWAY_URL")]
-        || process.env.IMPEL_GATEWAY_URL
         || config.gatewayUrl
         || resolveDefaultGateway(),
   );

package/src/commands/sessions.js

@@ -21,7 +21,7 @@ import { brandedEnvironmentName, RUNTIME_BRAND } from "../runtimeBrand.js";
 const MANAGED_SESSION_HOOK_FLAG = `${RUNTIME_BRAND.cli.command}-managed-session-hook-v1`;
 
 function environmentValue(suffix) {
-  return process.env[brandedEnvironmentName(suffix)] ?? process.env[`IMPEL_${suffix}`];
+  return process.env[brandedEnvironmentName(suffix)];
 }
 
 const SPEC = {

package/src/installRecovery/inference.js

@@ -12,7 +12,12 @@ import { tenantCredential } from "../tenants.js";
 export const DEFAULT_RECOVERY_ORG = "impel";
 const REQUEST_TIMEOUT_MS = 90_000;
 const MAX_RETRIES = 2;
-const FALLBACK_MODELS = ["claude-sonnet-5", "claude-haiku-4-5", "claude-opus-4-8"];
+const FALLBACK_MODELS = [
+  "claude-sonnet-5",
+  "claude-haiku-4-5",
+  "claude-opus-5",
+  "claude-opus-4-8",
+];
 
 function recoveryOrgCandidates(config, environment) {
   const preferred = String(environment.IMPEL_RECOVERY_ORG || DEFAULT_RECOVERY_ORG).trim();

package/src/sessionCollector.js

@@ -24,9 +24,7 @@ const SAFE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
 const TASK_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 
 function brandedEnvironmentValue(suffix) {
-  const branded = process.env[brandedEnvironmentName(suffix)];
-  if (branded !== undefined) return branded;
-  return process.env[`IMPEL_${suffix}`];
+  return process.env[brandedEnvironmentName(suffix)];
 }
 
 function stateRoot() {
@@ -509,7 +507,7 @@ function repositoryMetadata(cwd) {
   };
 }
 
-function sessionsUrl(config) {
+export function resolveSessionsUrl(config) {
   return String(
     brandedEnvironmentValue("SESSIONS_URL")
       || config?.sessionsUrl
@@ -545,7 +543,7 @@ async function apiRequest(config, tenantId, route, options = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
   try {
-    const response = await fetch(`${sessionsUrl(config)}${route}`, {
+    const response = await fetch(`${resolveSessionsUrl(config)}${route}`, {
       ...options,
       headers: requestHeaders(config, tenantId, options.headers),
       signal: controller.signal,